Skip to content

Commit 10ebc9a

Browse files
committed
SCC check: API and validation
1 parent f4e025b commit 10ebc9a

File tree

21 files changed

+1435
-1
lines changed

21 files changed

+1435
-1
lines changed

pkg/api/install/install.go

+1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
_ "github.com/openshift/origin/pkg/project/api/install"
1515
_ "github.com/openshift/origin/pkg/route/api/install"
1616
_ "github.com/openshift/origin/pkg/sdn/api/install"
17+
_ "github.com/openshift/origin/pkg/security/api/install"
1718
_ "github.com/openshift/origin/pkg/template/api/install"
1819
_ "github.com/openshift/origin/pkg/user/api/install"
1920
)

pkg/api/register.go

+1
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
_ "github.com/openshift/origin/pkg/project/api"
1313
_ "github.com/openshift/origin/pkg/route/api"
1414
_ "github.com/openshift/origin/pkg/sdn/api"
15+
_ "github.com/openshift/origin/pkg/security/api"
1516
_ "github.com/openshift/origin/pkg/template/api"
1617
_ "github.com/openshift/origin/pkg/user/api"
1718
)

pkg/api/v1/register.go

+1
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
_ "github.com/openshift/origin/pkg/project/api/v1"
1212
_ "github.com/openshift/origin/pkg/route/api/v1"
1313
_ "github.com/openshift/origin/pkg/sdn/api/v1"
14+
_ "github.com/openshift/origin/pkg/security/api/v1"
1415
_ "github.com/openshift/origin/pkg/template/api/v1"
1516
_ "github.com/openshift/origin/pkg/user/api/v1"
1617
)

pkg/api/validation/register.go

+6
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
projectvalidation "github.com/openshift/origin/pkg/project/api/validation"
1212
routevalidation "github.com/openshift/origin/pkg/route/api/validation"
1313
sdnvalidation "github.com/openshift/origin/pkg/sdn/api/validation"
14+
securityvalidation "github.com/openshift/origin/pkg/security/api/validation"
1415
templatevalidation "github.com/openshift/origin/pkg/template/api/validation"
1516
uservalidation "github.com/openshift/origin/pkg/user/api/validation"
1617
extvalidation "k8s.io/kubernetes/pkg/apis/extensions/validation"
@@ -23,6 +24,7 @@ import (
2324
projectapi "github.com/openshift/origin/pkg/project/api"
2425
routeapi "github.com/openshift/origin/pkg/route/api"
2526
sdnapi "github.com/openshift/origin/pkg/sdn/api"
27+
securityapi "github.com/openshift/origin/pkg/security/api"
2628
templateapi "github.com/openshift/origin/pkg/template/api"
2729
userapi "github.com/openshift/origin/pkg/user/api"
2830
"k8s.io/kubernetes/pkg/apis/extensions"
@@ -88,4 +90,8 @@ func registerAll() {
8890
Validator.MustRegister(&userapi.Identity{}, uservalidation.ValidateIdentity, uservalidation.ValidateIdentityUpdate)
8991
Validator.MustRegister(&userapi.UserIdentityMapping{}, uservalidation.ValidateUserIdentityMapping, uservalidation.ValidateUserIdentityMappingUpdate)
9092
Validator.MustRegister(&userapi.Group{}, uservalidation.ValidateGroup, uservalidation.ValidateGroupUpdate)
93+
94+
Validator.MustRegister(&securityapi.PodSecurityPolicySubjectReview{}, securityvalidation.ValidatePodSecurityPolicySubjectReview, nil)
95+
Validator.MustRegister(&securityapi.PodSecurityPolicySelfSubjectReview{}, securityvalidation.ValidatePodSecurityPolicySelfSubjectReview, nil)
96+
Validator.MustRegister(&securityapi.PodSecurityPolicyReview{}, securityvalidation.ValidatePodSecurityPolicyReview, nil)
9197
}

pkg/cmd/cli/describe/describer_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
oauthapi "github.com/openshift/origin/pkg/oauth/api"
2525
projectapi "github.com/openshift/origin/pkg/project/api"
2626
sdnapi "github.com/openshift/origin/pkg/sdn/api"
27+
securityapi "github.com/openshift/origin/pkg/security/api"
2728

2829
// install all APIs
2930
_ "github.com/openshift/origin/pkg/api/install"
@@ -65,6 +66,9 @@ var DescriberCoverageExceptions = []reflect.Type{
6566
reflect.TypeOf(&authorizationapi.LocalSubjectAccessReview{}),
6667
reflect.TypeOf(&authorizationapi.LocalResourceAccessReview{}),
6768
reflect.TypeOf(&authorizationapi.SelfSubjectRulesReview{}),
69+
reflect.TypeOf(&securityapi.PodSecurityPolicySubjectReview{}),
70+
reflect.TypeOf(&securityapi.PodSecurityPolicySelfSubjectReview{}),
71+
reflect.TypeOf(&securityapi.PodSecurityPolicyReview{}),
6872
}
6973

7074
// MissingDescriberCoverageExceptions is the list of types that were missing describer methods when I started

pkg/cmd/cli/describe/printer_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ import (
1919
deployapi "github.com/openshift/origin/pkg/deploy/api"
2020
imageapi "github.com/openshift/origin/pkg/image/api"
2121
projectapi "github.com/openshift/origin/pkg/project/api"
22+
securityapi "github.com/openshift/origin/pkg/security/api"
2223
)
2324

2425
// PrinterCoverageExceptions is the list of API types that do NOT have corresponding printers
@@ -44,6 +45,9 @@ var PrinterCoverageExceptions = []reflect.Type{
4445
reflect.TypeOf(&buildapi.BinaryBuildRequestOptions{}),
4546
reflect.TypeOf(&buildapi.BuildRequest{}),
4647
reflect.TypeOf(&buildapi.BuildLogOptions{}),
48+
reflect.TypeOf(&securityapi.PodSecurityPolicySubjectReview{}),
49+
reflect.TypeOf(&securityapi.PodSecurityPolicySelfSubjectReview{}),
50+
reflect.TypeOf(&securityapi.PodSecurityPolicyReview{}),
4751
}
4852

4953
// MissingPrinterCoverageExceptions is the list of types that were missing printer methods when I started

pkg/scheduler/admission/podnodeconstraints/admission.go

+4
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
configlatest "github.com/openshift/origin/pkg/cmd/server/api/latest"
2222
deployapi "github.com/openshift/origin/pkg/deploy/api"
2323
"github.com/openshift/origin/pkg/scheduler/admission/podnodeconstraints/api"
24+
securityapi "github.com/openshift/origin/pkg/security/api"
2425
)
2526

2627
func init() {
@@ -77,6 +78,9 @@ var resourcesToCheck = map[unversioned.GroupResource]unversioned.GroupKind{
7778
// we choose not to handle in this plugin
7879
var resourcesToIgnore = []unversioned.GroupKind{
7980
extensions.Kind("DaemonSet"),
81+
securityapi.Kind("PodSecurityPolicySelfSubjectReview"), // TODO: should this go through admission?
82+
securityapi.Kind("PodSecurityPolicySubjectReview"), // TODO: should this go through admission?
83+
securityapi.Kind("PodSecurityPolicyReview"), // TODO: should this go through admission?
8084
}
8185

8286
func shouldCheckResource(resource unversioned.GroupResource, kind unversioned.GroupKind) (bool, error) {

pkg/scheduler/admission/podnodeconstraints/admission_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@ func hasPodSpec(t reflect.Type) bool {
450450
if t == podSpecType {
451451
return true
452452
}
453-
for i := 1; i < t.NumField(); i++ {
453+
for i := 0; i < t.NumField(); i++ {
454454
if hasPodSpec(t.Field(i).Type) {
455455
return true
456456
}
+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
// +build !ignore_autogenerated
2+
3+
// This file was autogenerated by deepcopy-gen. Do not edit it manually!
4+
5+
package api
6+
7+
import (
8+
api "k8s.io/kubernetes/pkg/api"
9+
unversioned "k8s.io/kubernetes/pkg/api/unversioned"
10+
conversion "k8s.io/kubernetes/pkg/conversion"
11+
)
12+
13+
func init() {
14+
if err := api.Scheme.AddGeneratedDeepCopyFuncs(
15+
DeepCopy_api_PodSecurityPolicyReview,
16+
DeepCopy_api_PodSecurityPolicyReviewSpec,
17+
DeepCopy_api_PodSecurityPolicyReviewStatus,
18+
DeepCopy_api_PodSecurityPolicySelfSubjectReview,
19+
DeepCopy_api_PodSecurityPolicySelfSubjectReviewSpec,
20+
DeepCopy_api_PodSecurityPolicySubjectReview,
21+
DeepCopy_api_PodSecurityPolicySubjectReviewSpec,
22+
DeepCopy_api_PodSecurityPolicySubjectReviewStatus,
23+
DeepCopy_api_ServiceAccountPodSecurityPolicyReviewStatus,
24+
); err != nil {
25+
// if one of the deep copy functions is malformed, detect it immediately.
26+
panic(err)
27+
}
28+
}
29+
30+
func DeepCopy_api_PodSecurityPolicyReview(in PodSecurityPolicyReview, out *PodSecurityPolicyReview, c *conversion.Cloner) error {
31+
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
32+
return err
33+
}
34+
if err := DeepCopy_api_PodSecurityPolicyReviewSpec(in.Spec, &out.Spec, c); err != nil {
35+
return err
36+
}
37+
if err := DeepCopy_api_PodSecurityPolicyReviewStatus(in.Status, &out.Status, c); err != nil {
38+
return err
39+
}
40+
return nil
41+
}
42+
43+
func DeepCopy_api_PodSecurityPolicyReviewSpec(in PodSecurityPolicyReviewSpec, out *PodSecurityPolicyReviewSpec, c *conversion.Cloner) error {
44+
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
45+
return err
46+
}
47+
if in.ServiceAccountNames != nil {
48+
in, out := in.ServiceAccountNames, &out.ServiceAccountNames
49+
*out = make([]string, len(in))
50+
copy(*out, in)
51+
} else {
52+
out.ServiceAccountNames = nil
53+
}
54+
return nil
55+
}
56+
57+
func DeepCopy_api_PodSecurityPolicyReviewStatus(in PodSecurityPolicyReviewStatus, out *PodSecurityPolicyReviewStatus, c *conversion.Cloner) error {
58+
if in.AllowedServiceAccounts != nil {
59+
in, out := in.AllowedServiceAccounts, &out.AllowedServiceAccounts
60+
*out = make([]ServiceAccountPodSecurityPolicyReviewStatus, len(in))
61+
for i := range in {
62+
if err := DeepCopy_api_ServiceAccountPodSecurityPolicyReviewStatus(in[i], &(*out)[i], c); err != nil {
63+
return err
64+
}
65+
}
66+
} else {
67+
out.AllowedServiceAccounts = nil
68+
}
69+
return nil
70+
}
71+
72+
func DeepCopy_api_PodSecurityPolicySelfSubjectReview(in PodSecurityPolicySelfSubjectReview, out *PodSecurityPolicySelfSubjectReview, c *conversion.Cloner) error {
73+
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
74+
return err
75+
}
76+
if err := DeepCopy_api_PodSecurityPolicySelfSubjectReviewSpec(in.Spec, &out.Spec, c); err != nil {
77+
return err
78+
}
79+
if err := DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in.Status, &out.Status, c); err != nil {
80+
return err
81+
}
82+
return nil
83+
}
84+
85+
func DeepCopy_api_PodSecurityPolicySelfSubjectReviewSpec(in PodSecurityPolicySelfSubjectReviewSpec, out *PodSecurityPolicySelfSubjectReviewSpec, c *conversion.Cloner) error {
86+
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
87+
return err
88+
}
89+
return nil
90+
}
91+
92+
func DeepCopy_api_PodSecurityPolicySubjectReview(in PodSecurityPolicySubjectReview, out *PodSecurityPolicySubjectReview, c *conversion.Cloner) error {
93+
if err := unversioned.DeepCopy_unversioned_TypeMeta(in.TypeMeta, &out.TypeMeta, c); err != nil {
94+
return err
95+
}
96+
if err := DeepCopy_api_PodSecurityPolicySubjectReviewSpec(in.Spec, &out.Spec, c); err != nil {
97+
return err
98+
}
99+
if err := DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in.Status, &out.Status, c); err != nil {
100+
return err
101+
}
102+
return nil
103+
}
104+
105+
func DeepCopy_api_PodSecurityPolicySubjectReviewSpec(in PodSecurityPolicySubjectReviewSpec, out *PodSecurityPolicySubjectReviewSpec, c *conversion.Cloner) error {
106+
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
107+
return err
108+
}
109+
out.User = in.User
110+
if in.Groups != nil {
111+
in, out := in.Groups, &out.Groups
112+
*out = make([]string, len(in))
113+
copy(*out, in)
114+
} else {
115+
out.Groups = nil
116+
}
117+
return nil
118+
}
119+
120+
func DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in PodSecurityPolicySubjectReviewStatus, out *PodSecurityPolicySubjectReviewStatus, c *conversion.Cloner) error {
121+
if in.AllowedBy != nil {
122+
in, out := in.AllowedBy, &out.AllowedBy
123+
*out = new(api.ObjectReference)
124+
if err := api.DeepCopy_api_ObjectReference(*in, *out, c); err != nil {
125+
return err
126+
}
127+
} else {
128+
out.AllowedBy = nil
129+
}
130+
out.Reason = in.Reason
131+
if err := api.DeepCopy_api_PodSpec(in.PodSpec, &out.PodSpec, c); err != nil {
132+
return err
133+
}
134+
return nil
135+
}
136+
137+
func DeepCopy_api_ServiceAccountPodSecurityPolicyReviewStatus(in ServiceAccountPodSecurityPolicyReviewStatus, out *ServiceAccountPodSecurityPolicyReviewStatus, c *conversion.Cloner) error {
138+
if err := DeepCopy_api_PodSecurityPolicySubjectReviewStatus(in.PodSecurityPolicySubjectReviewStatus, &out.PodSecurityPolicySubjectReviewStatus, c); err != nil {
139+
return err
140+
}
141+
out.Name = in.Name
142+
return nil
143+
}

pkg/security/api/install/install.go

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
package install
2+
3+
import (
4+
"fmt"
5+
6+
"github.com/golang/glog"
7+
8+
kapi "k8s.io/kubernetes/pkg/api"
9+
"k8s.io/kubernetes/pkg/api/meta"
10+
"k8s.io/kubernetes/pkg/api/unversioned"
11+
"k8s.io/kubernetes/pkg/apimachinery"
12+
"k8s.io/kubernetes/pkg/apimachinery/registered"
13+
"k8s.io/kubernetes/pkg/runtime"
14+
"k8s.io/kubernetes/pkg/util/sets"
15+
16+
"github.com/openshift/origin/pkg/security/api"
17+
"github.com/openshift/origin/pkg/security/api/v1"
18+
)
19+
20+
const importPrefix = "github.com/openshift/origin/pkg/security/api"
21+
22+
var accessor = meta.NewAccessor()
23+
24+
// availableVersions lists all known external versions for this group from most preferred to least preferred
25+
var availableVersions = []unversioned.GroupVersion{v1.SchemeGroupVersion}
26+
27+
func init() {
28+
registered.RegisterVersions(availableVersions)
29+
externalVersions := []unversioned.GroupVersion{}
30+
for _, v := range availableVersions {
31+
if registered.IsAllowedVersion(v) {
32+
externalVersions = append(externalVersions, v)
33+
}
34+
}
35+
if len(externalVersions) == 0 {
36+
glog.Infof("No version is registered for group %v", api.GroupName)
37+
return
38+
}
39+
40+
if err := registered.EnableVersions(externalVersions...); err != nil {
41+
panic(err)
42+
}
43+
if err := enableVersions(externalVersions); err != nil {
44+
panic(err)
45+
}
46+
}
47+
48+
// TODO: enableVersions should be centralized rather than spread in each API
49+
// group.
50+
// We can combine registered.RegisterVersions, registered.EnableVersions and
51+
// registered.RegisterGroup once we have moved enableVersions there.
52+
func enableVersions(externalVersions []unversioned.GroupVersion) error {
53+
addVersionsToScheme(externalVersions...)
54+
preferredExternalVersion := externalVersions[0]
55+
56+
groupMeta := apimachinery.GroupMeta{
57+
GroupVersion: preferredExternalVersion,
58+
GroupVersions: externalVersions,
59+
RESTMapper: newRESTMapper(externalVersions),
60+
SelfLinker: runtime.SelfLinker(accessor),
61+
InterfacesFor: interfacesFor,
62+
}
63+
64+
if err := registered.RegisterGroup(groupMeta); err != nil {
65+
return err
66+
}
67+
kapi.RegisterRESTMapper(groupMeta.RESTMapper)
68+
return nil
69+
}
70+
71+
func addVersionsToScheme(externalVersions ...unversioned.GroupVersion) {
72+
// add the internal version to Scheme
73+
api.AddToScheme(kapi.Scheme)
74+
// add the enabled external versions to Scheme
75+
for _, v := range externalVersions {
76+
if !registered.IsEnabledVersion(v) {
77+
glog.Errorf("Version %s is not enabled, so it will not be added to the Scheme.", v)
78+
continue
79+
}
80+
switch v {
81+
case v1.SchemeGroupVersion:
82+
v1.AddToScheme(kapi.Scheme)
83+
default:
84+
glog.Errorf("Version %s is not known, so it will not be added to the Scheme.", v)
85+
continue
86+
}
87+
}
88+
}
89+
90+
func newRESTMapper(externalVersions []unversioned.GroupVersion) meta.RESTMapper {
91+
rootScoped := sets.NewString()
92+
ignoredKinds := sets.NewString()
93+
return kapi.NewDefaultRESTMapper(externalVersions, interfacesFor, importPrefix, ignoredKinds, rootScoped)
94+
}
95+
96+
func interfacesFor(version unversioned.GroupVersion) (*meta.VersionInterfaces, error) {
97+
switch version {
98+
case v1.SchemeGroupVersion:
99+
return &meta.VersionInterfaces{
100+
ObjectConvertor: kapi.Scheme,
101+
MetadataAccessor: accessor,
102+
}, nil
103+
104+
default:
105+
g, _ := registered.Group(api.GroupName)
106+
return nil, fmt.Errorf("unsupported storage version: %s (valid: %v)", version, g.GroupVersions)
107+
}
108+
}

0 commit comments

Comments
 (0)